My Tutors reasoning of how NAT provides security [closed]

Question

I don't consider NAT a security measure at all but here is my teachers reasoning of how NAT provides security. My course has been appalling and this reasoning is just laughable to me. This is a £3000 course and this is his explanation.

"If you cannot see or ‘ping’ an internal IP address range, you cannot ‘see’ any devices on the internal network, so cannot gain access to implement any form of malicious intrusion"

If you can't ping the the internal IP this is just stupid - Yes there is DDos attack but this as a explanation, really? I'm in the process of making a formal complaint about the course and this is just one of the things.

Do you regard the tutors statement to be correct? And if not what is wrong with the statement?

Answer 1

The explanation of your tutor is somewhat correct, but as with anything in life, the truth runs a lot deeper.

What is true

In a very simple NAT setup, in which the router receives one external IP address, and all devices in the internal network are NAT'ed through that IP address, it is indeed true that external devices cannot simply communicate with any internal device.

Consider the following network graph:

┌───────────┐                      ┌────────┐
│           │        233.252.17.56 │        │
│ Internet  │◄────────────────────►│ Router │
│           │                      │        │
└───────────┘                      └────────┘
                                        ▲ 10.0.0.1
                                        │
                                        │
                                        │
                      ┌─────────────────┼───────────────────┐
                      │                 │                   │
                      │                 │                   │
                      │                 │                   │
                      ▼ 10.0.0.4        ▼ 10.0.0.100        ▼ 10.0.0.2
                    ┌────┐         ┌────────┐            ┌─────┐
                    │    │         │        │            │     │
                    │ PC │         │ Laptop │            │ NAS │
                    │    │         │        │            │     │
                    └────┘         └────────┘            └─────┘

An attacker would have no way to directly communicate with the PC at 10.0.0.4, as no port on the router's NAT table would route the packet to the PC.

So in this case, it would indeed improve security, even if any such improvement was merely by coincidence.

What is false

The explanation of "If you can't ping, you can't attack" is just completely wrong. A good example would be nmap's -Pn flag, which ignores any attempts at pinging a host and simply attempts to enumerate open ports. If any such ports are found, an attacker can communicate with the server behind that port, which means it can also be attacked.

Nowadays, DNAT (destination NAT, also called port forwarding) is often used to expose services within a NAT'ed network to the internet. For example, the PC in our previous scenario may host an Unreal Tournament 2004 server on port 7777. This would mean that communicating with 233.252.17.56:7777 would be forwarded by the router to 10.0.0.4:7777. This in turn would allow an attacker to communicate with this service and therefore attack it.

In short

NAT is not a security measure per sé. But it does limit the exposure of devices from an internal network to the outside, which makes exploitation more difficult.