On a directly connected outside system, you can set a route for your LAN address space via that router and it will just work. It requires telco or physical access but I have in fact done this before.

> what happens with an incoming packet if there are no firewall rules on the NAT gateway/middlebox?

See perhaps stateless NAT:

* https://wiki.nftables.org/wiki-nftables/index.php/Performing...

>what happens with an incoming packet if there are no firewall rules on the NAT gateway/middlebox?

You get a Full Cone NAT. Once the middlebox maps an (internal IP, port) tuple to an external port, every connection to that external port would lead to that internal tuple.

Why should Host C be able to reach Host A, when Host A is only speaking to Host B?

I am sure you know this but still, I have to stress that NAT is merely a mapper from one tuple to another tuple. If your router can handle NAT it certainly can handle an IPv6 firewall. And modern home/SOHO routers come with IPv6 firewall enabled by default (for the non-home routers, you have a bigger issue if your networking guys are not checking whether firewall is active) so I find the firewall discussions utterly as meaningless as someone fearing their DHCP server is not turned on by default. And frankly speaking, it's just an excuse for not implementing IPv6 -- saying that your ISP doesn't provide IPv6 connectivity would have been more convincing.

Thanks, I wasn't familiar with this term!

I think you misunderstand my post. My "philosophical inquiry" is about trying to get to the bottom of this, and it seem to me that NAT, as virtually everywhere deployed and found in the unspeakably many SoHo setups, is a stateful NAT, and it's implicitly a bad firewall.

So when people say that this is "meme" should die .... well they are right, but not technically right, no?

> If your router can handle NAT it certainly can handle an IPv6 firewall.

The point is not that "it can", the point is that on ipv4 "it doesn't work without".

In order for ipv4 to work at all you MUST use NAT, and implicitly a firewall, those two always work together even if there the person installing the system doesn't know the word "firewall", which is usually the case.

> The point is not that "it can", the point is that on ipv4 "it doesn't work without".

Hmm. I hadn't seen this brought up and I think it's a stronger argument than most others.

The IPv6 equivalent is services on ULA only, but that's not a default behaviour.

This argument isn't as strong as you think it is. You are assuming protocol dysfunction is protecting you, when the physical reality is that your router's firewall is what's preventing external packets over the wire from negatively influencing your network. Recall that your router isn't behind a NAT, but in front of it.

Consider what would happen if you have NAT but your firewall "doesn't work", would the ability to route packets to addresses in your local network act as an extra layer of protection in this case, as you imply? Absolutely not, since your router's IP is still clearly exposed to the internet, and without a functional firewall they can just remotely connect to its configuration interface and change your network topology as they see fit. Ultimately at the end of the day, anything that could reasonably compromise your firewalls capabilities can equally work around NAT.

Not to mention that unlike IPv4, in which the address space is so small you can feasibly brute force the entire local address range to discover any open ports in the event you compromise an internal node past the firewall, with IPv6, the address range becomes so large, bad actors must resort to alternative more complicated means for mapping the network topology.

Ofc neither matter in the end if your router gets compromised. The only reason so many people believe NAT protects them is because they are "buying" into the abstraction more than they are about the physical reality of how these systems are built & function.