The standard defense against the Kaminsky attack is to use source port randomization for all DNS requests.
Does NAT break the security benefits of source port randomization?
In more detail, consider a client that sits behind a NAT. Suppose the client uses source port randomization for all DNS requests, and issues a request. When the request traverses the NAT, the NAT may translate the source port number to a new source port from within the NAT's pool of local port numbers.
I worry that, if the NAT uses a predictable port assignment strategy, this may derandomize the source port on the packet -- leaving the client open to a Kaminsky attack. Does this happen in practice? Do NATs translate the source port on DNS requests? Do they use predictable source ports? If this is a problem for some NATs, does anyone know how prevalent the problem is? Do NATs these days take any measures to avoid screwing up source port randomization? Is there anything one should do, when configuring a NAT, to ensure the NAT doesn't make you more vulnerable to Kaminsky attacks?