Re:The New Internet
by yesco on Monday July 29, 2024 @11:46AM
(#41101330)
This argument isn't as strong as you think it is. You are assuming protocol dysfunction is protecting you, when the physical reality is that your router's firewall is what's preventing external packets over the wire from negatively influencing your network. Recall that your router isn't behind a NAT, but in front of it.
Consider what would happen if you have NAT but your firewall "doesn't work", would the ability to route packets to addresses in your local network act as an extra layer of protection in this case, as you imply? Absolutely not, since your router's IP is still clearly exposed to the internet, and without a functional firewall they can just remotely connect to its configuration interface and change your network topology as they see fit. Ultimately at the end of the day, anything that could reasonably compromise your firewalls capabilities can equally work around NAT.
Not to mention that unlike IPv4, in which the address space is so small you can feasibly brute force the entire local address range to discover any open ports in the event you compromise an internal node past the firewall, with IPv6, the address range becomes so large, bad actors must resort to alternative more complicated means for mapping the network topology.
Ofc neither matter in the end if your router gets compromised. The only reason so many people believe NAT protects them is because they are "buying" into the abstraction more than they are about the physical reality of how these systems are built & function.
Consider what would happen if you have NAT but your firewall "doesn't work", would the ability to route packets to addresses in your local network act as an extra layer of protection in this case, as you imply? Absolutely not, since your router's IP is still clearly exposed to the internet, and without a functional firewall they can just remotely connect to its configuration interface and change your network topology as they see fit. Ultimately at the end of the day, anything that could reasonably compromise your firewalls capabilities can equally work around NAT.
Not to mention that unlike IPv4, in which the address space is so small you can feasibly brute force the entire local address range to discover any open ports in the event you compromise an internal node past the firewall, with IPv6, the address range becomes so large, bad actors must resort to alternative more complicated means for mapping the network topology.
Ofc neither matter in the end if your router gets compromised. The only reason so many people believe NAT protects them is because they are "buying" into the abstraction more than they are about the physical reality of how these systems are built & function.