I just bought a new router, and as usual the router manufacturer make a big deal out of the firewall.

I have never understood why the firewall is needed, sure, stopping dos attacks (such as syn-floods) is great, but that's the only useful thing I can think of.

As long as the services I expose to the external interface (by manually adding nat-entries) haven't got unpatched exploits isn't my lan already secure against external agents?

  • 1
    get ready for a lot of info flooding your way - I'll just step aside for this one ....
    – schroeder
    Commented Feb 29, 2012 at 22:29
  • Let's see...Zero-day attacks, application-level attacks, misconfiguration, etc. I'm with @schroeder on this one. Commented Feb 29, 2012 at 22:32
  • 4
    I think it may be a case of "if you have to ask - then you REALLY need it" ...
    – schroeder
    Commented Feb 29, 2012 at 22:33
  • This is a duplicate of other questions previously asked; see my answer for links.
    – D.W.
    Commented Mar 1, 2012 at 3:13
  • Defense in depth? Real defenses depend on several layers, not just one sandcastle wall easily melted when the first exploitable vulnerability gets pwned. Commented Mar 1, 2012 at 6:00

3 Answers 3


Please read the following previously asked questions:

They answer all of your questions.

The short version is:

  • NAT does not automatically imply that all inbounded connections are blocked. NAT and firewalls are, in principle, orthogonal. Generally speaking, most NAT boxes also happen to provide some firewall-like protection: they tend to block incoming connections. This is not an inherent or necessary property of NAT; it is just that most consumer devices that provide NAT also happen to provide this sort of firewalling as well.

  • Blocking inbound connections (whether you want to attribute it to the firewalling functionality or the NAT functionality) provides a basic level of defense that works pretty well against a common class of attacks. That makes it a good thing.

  • No, neither a firewall nor a NAT implies that your network is totally secure against external agents. Blocking inbound connections provides a level of defense against certain attacks, but not by any means all attacks.

But you really need to read the prior answers. I'm not going to repeat all of the excellent points made there.


You, in effect, already have a (poor form of) firewall by relying on port address translation. I am assuming you are truly doing port address translation by the contents of your post. The question you are then asking is why do I need a firewall for my firewall. If you do have network address translation, you are not just exposing specific services to the external interface. You would be exposing an IP externally thereby having no control over what services may be accessed.

So to answer your question, if you are doing port address translation and exposing only patched specific services to the internet why do you need a firewall? You do not.

If you are asking why would I need to restrict which ports and address are directly routeable from the internet into my network, well... I really can't help you there.

  • mostly true - except for zero-days, which may or may not worry @monoceres :-)
    – Rory Alsop
    Commented Feb 29, 2012 at 23:43

There is a pretty big difference between NAT/PAT and a firewall capable of doing stateful packet inspection.

A decent firewall can actually tell if an incoming packet was unsolicited or if it was requested by an inside host, this will keep out a lot of unwanted traffic from port scanners and other intrusion attempts.

They are also protocol aware and can handle stuff like FTP traffic, which starts on port 21 but then listens on random higher level ports.

They may also provide other services such as VPN, content filtering, and can log traffic for auditing purposes.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .