Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm following discussions about the IPv4->IPv6 transition, and IPv6 doesn't seem to like NAT at all.

I've always thought that NAT was helpful in v4 for some security, I know it doesn't really hide the computers but it makes them harder to get to, certainly it makes it easy to limit access to ports on the computers behind the NAT gateway.

The IPv6 contention is that it doesn't provide security, that real firewalls and gateway routers should be used instead. I don't like the idea of my entire home network being exposed on the internet.

So, is this a good or bad thing?

share|improve this question
I wouldn't say Network Address Translation is primarily about security. It's about letting you have a single external IP address, which can translate internally to a whole network, on its own range of IPs and subnets. Sure that has benefits to it, but I see it more as a "fix" to the IPv4 shortage. – user3463 Jan 25 '11 at 20:57
Other than the fact that pretty much everything with NAT has something firewall like, they are pretty similar. NAT generally (IIUC) drops connections to a port that it didn't open to send out on, and therefore is making you more safe that way. – tobylane Jan 25 '11 at 22:04
WAIT, does that mean every computer on your network will get a public IPV6? I mean, we have enough IPV6s to do that, so... Do people just get an IPV6 range with their internet package? Also if this is true that gives ISPs the possibility to limit the number of computers you can have in your network when the router explicitly does not exhibit NAT. I sure hope so. I misread probably. – sinni800 Jan 28 '11 at 7:23
See these questions on serverfault for a more technically detailed answers.… – Zoredache Jan 28 '11 at 8:11
up vote 5 down vote accepted

NAT allows a certain type of security, in that people outside of your network can not initiate connections to the inside of your network. This cuts down on worms and other classes of malware. This helps some.

Things it doesn't help:

  • Other malware from the outside. Viruses, drive by browser hijacks, trojans.
  • Any attack from the inside. If any computer is compromised internally, they have free rein on your other computers.

It is not a firewall.

  • Firewalls can block traffic both directions. This can help block malware from connecting to control computers, or downloading new code. But this needs to be configured.
  • Firewalls can be configured to log what they block, NAT isn't blocking anything, nothing to log.
  • Firewalls can block specific IP addresses from attacking your network. NAT is pretty much all (you configure port forwarding to a server in your internal net) or nothing.
  • A good firewall can rate limit, mitigating some DOS attacks. NAT, still all or nothing.
  • Probably other cool stuff, since I haven't kept up with firewall cool features in a while.

So, you still need firewalls on all internal computers, because if anything is compromised, it can take over anything else in your network. Remember that terms like worms, viruses, trojans don't mean much anymore. Any malware can download a big payload and then use multiple attack vectors inside your network. IE zero day exploits can compromise one computer on your net, and take down it all.

So, the point is, it does provide a subset of security on a specific direction, but it doesn't mean you can be less secure about anything else. You still need to do best practices about everything else, so most people say it doesn't give any security, which is confusing because it does provide some.

share|improve this answer
I agree that NAT is not a firewall, but I believe you would find it very difficult to find a device that is capable of NAT, and not able to do L3 packet filtering if you had a good level of access to the kernel. Almost every device performing NAT these days do it as part of stateful packet filter (ie firewall). – Zoredache Jan 28 '11 at 8:08

Primarily, NAT is a fix for the IPv4 shortage issue. As a side benefit it limits access to internal machines which provides a firewall-like function.

All the NAT routers I've used (home use only) have also had a firewall built in. If yo decide not to NAT you still need a firewall because all your internal machines are exposed without one.

share|improve this answer

This topic is really interesting - thank you for asking Neth.

Here's my thought - NAT being a security feature is really a tangential benefit. It's main purpose is to share a single IP across multiple systems. There are situations like when you buy the cheaper Comcast internet, they only give you a single static IP address. That means to have multiple systems online simultaneously, your router has to manage them through NAT.

I appreciate the security fear of it, but everyone above is right - security is based on your firewall, not your NAT setup.

There are interesting/cool options to look into if security is your thing.

1) Do the basics first - check your router for firewall settings. If it doesn't have anything worthwhile, google it and see if you can flash it with DD-WRT (open source and bad a$$ router OS).

2) Abstract your IP address through (a) Running anything private within a virtual machine on your system (b) using a proxy server or service like the Cocoon add-on for FF (c) Installing Tor.

This kind of thought can go on for a while, so I'll leave it at here for now. Godspeed in protecting yourself online.

share|improve this answer

This is pretty much subjective ;)

My two cents: Yes, NAT does increase security in that it acts as a partial firewall that comes "for free". But you're already making my point: This just makes a real firewall necessary. But that doesn't mean that it has to be desktop firewalls - many commodity IPv4 routers already come with a firewall on top of NAT.

To sum everything up: If there's a functional, properly configured firewall on the router, computers on an IPv6 network without NAT will still have as many ports open to the world as it was with IPv4 (none), and instead of forwarding ports, you're making firewall exceptions.

share|improve this answer

NAT is not a security feature.

To prove this to yourself, visualize a NAT router without a firewall. Every external port that was used by an internal machine is simply left open.

A NAT setup like this would provide no security because anyone on the outside could just connect to your internal ports through the last external port you used.

As a matter of fact, UDP is already implemented like that because there is no connection for the NAT gateway to track. Okay, I lied a little bit because the UDP is limited to receiving from the last IP that was sent to. But to scare everyone, back when NAT was new some vendors didn't get this right and the UDP ports were open to the world.

So what provides the actual security in a NAT gateway is not the NAT but is the stateful firewall.

The comments claiming that I am wrong keep confusing the firewall with the NAT operation. They have obviously never played with an older router (1998'ish) that simply assigned port mapping based on a packet trigger. These routers had no state tracking and no firewalling, yet they were implementing NAT. Without security. Which is my point.

share|improve this answer
They would only be able to connect to ports on the router. Barring NAT entries for incoming connections, there is no routing to internal servers. – BillThor Jan 26 '11 at 3:48
@BillThor: Nope. You're thinking of the firewall. Why do you think a pure NAT box would not route to internal servers? – Zan Lynx Jan 26 '11 at 5:37
No connection for the NAT gateway to track. This statement is extremely wrong. NAT works specifically because stateful tracking is done. You can't have port address translation without a tracking connection state. TCP NAT translations are easy to track since a SYN, and FIN packet mark the start and end of a connection. UDP translations are quickly timed out after a short period of inactivity. – Zoredache Jan 28 '11 at 8:06
@Zoredache: You are actually wrong. NAT does not require state tracking. Early versions of NAT assigned an incoming port based on outgoing traffic and simply maintained that association until a timeout was reached. This port assignment did not need to filter incoming source IPs either, but would accept any incoming traffic and route it to the internal network. Why people continue to downvote me for this, I don't know. – Zan Lynx Jan 29 '11 at 0:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .