2

Connecting through wifi adds the benefit of being behind NAT. Why do cellphones not simulate being behind a nat network when connecting directly to the internet to limit the attack surface? Or, is there software that has implemented this?

  • 2
    That's down to the mobile network not the handset. Most do en.wikipedia.org/wiki/Carrier-grade_NAT – paj28 Jul 19 '17 at 16:27
  • I suppose that explains why it has an address in 10.***.***.***, I'd upvote your comment if I could – flerb Jul 19 '17 at 16:30
  • 1
    NAT does not provide security. It only looks like it does. A device with no open inbound ports has no additional protection being behind NAT. (Although the NAT device may provide some firewall features that enhance security, NAT itself does not help.) – myron-semack Jul 19 '17 at 16:54
  • Doesn't it add some security? eg. I can't portscan my phone without being on the same network as it because it has a public IP address. I was interested in the idea of limiting attack surface by using nat combined with a firewall within the phone, and then using that to monitor traffic like iptables can do. But yah, if the ports are closed then I understand it doesn't do anything. – flerb Jul 19 '17 at 17:04
2

NAT does not explicitly add security. It only implicitly adds security because it needs to keep a state for all outgoing connections to map incoming packets back to the originating connection - and thus implicitly denies any incoming packets which don't match an outgoing connection. But, this security can already be done with a stateful packet filter (like iptables) which is usually the base for a NAT solution anyway.

But, this kind of security is actually only needed to protect services on the phone which accept packets from outside even though they don't expect such packets. This means services which bind to any address instead of only the localhost address. Usually there are no such services, i.e. either they bind to localhost only or they actually expect traffic from outside.

That does not mean that such a packet filter is not useful on mobile devices. It actually is very useful because for example on a rooted Android phone you can use the builtin iptables with a nice interface (such as Android Firewall) to limit which applications can access the local network, use WLAN, use mobile data or even can be used with roaming.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.