Re:The Ripe NCC Has Run Out of IPv4 Addresses
by icedchai on Monday November 25, 2019 @06:49PM
(#21634217)
So in other words, even without a firewall, it still provides some level of security. If your attacker can't route to your target's addresses because they are private RFC1918, they're "blocked" for all practical purposes. Yes, I know they're not technically blocked... but the typical attacker 10 hops away isn't going to know...
Re:The Ripe NCC Has Run Out of IPv4 Addresses
by zAy0LfpBZLC8mAC on Monday November 25, 2019 @07:39PM
(#21634528)
On the other hand, this might also give other people a false sense of security. Most people who tell you that "NAT provides security" think that NAT somehow drops packets, and if your network is actually targeted, this myth might well be the reason why someone ends up downloading all your files by connecting to your file server through your NAT gateway.
Re:The Ripe NCC Has Run Out of IPv4 Addresses
by Dagger2 on Tuesday November 26, 2019 @09:48PM
(#21644855)
No... it doesn't drop connections, so it doesn't provide any security.
Re:The Ripe NCC Has Run Out of IPv4 Addresses
by icedchai on Wednesday November 27, 2019 @09:18AM
(#21647987)
In practical terms, it still provides some (low) level of security. If an attacker can't get IP packets to your machine because it's on an un-routable address, they can't attack it. If your attacker is getting "cooperation" from your ISP to route to it, you have bigger things to worry about it.
Obviously you should really use a firewall...
Re:The Ripe NCC Has Run Out of IPv4 Addresses
by Dagger2 on Thursday November 28, 2019 @10:22AM
(#21657898)
It won't prevent an attacker from getting IP packets to your machine. How could it do that, when it only acts on outbound connections and its only act is to change the apparent source address of those connections?
Re:The Ripe NCC Has Run Out of IPv4 Addresses
by icedchai on Thursday November 28, 2019 @11:07AM
(#21658261)
Did you miss "because it's on an un-routable address" part? If there's no route to your machine from an attacker, they can't attack you.
Re:The Ripe NCC Has Run Out of IPv4 Addresses
by Dagger2 on Thursday November 28, 2019 @02:02PM
(#21659500)
The discussion was about the behavior of PAT, and PAT has no influence on whether or not an attacker has a route to you.
Re:The Ripe NCC Has Run Out of IPv4 Addresses
by icedchai on Thursday November 28, 2019 @03:28PM
(#21659983)
The discussion is about NAT and PAT in general. 99% of the time it is used with unrouteable private addresses. This means even in the absence of a firewall there is still some level of security. End of story.
Re:The Ripe NCC Has Run Out of IPv4 Addresses
by Dagger2 on Friday November 29, 2019 @05:29PM
(#21667196)
It's common to use it with RFC1918 addresses, but that still doesn't change the behavior of PAT. PAT will not drop connections, and thus won't provide you with security.
Re:The Ripe NCC Has Run Out of IPv4 Addresses
by icedchai on Friday November 29, 2019 @08:54PM
(#21668010)
Security is not black or white, it is shades of gray. We'll just have to disagree.
Here's how you do "PAT" on Linux: `iptables -t nat -A POSTROUTING -o wan0 -j MASQUERADE`. Notice how it's limited to outbound connections ("-o wan0")? That means it doesn't apply to inbound connections, and thus doesn't have any effect on the behavior of inbound connections.
If it doesn't have any effect on the behavior of inbound connections, then how could it possibly block inbound connections?
(The typical consumer configuration pairs "PAT" with a firewall, and the firewall does block inbound connections. It's also typical to pair it with RFC1918 addresses, which doesn't block connections but does make it much harder for most people to make the relevant connections in the first place. None of that changes the fact that "PAT" doesn't block connections.)