0

Truth or bald-faced lie: the cheap $50 router you can pick up at your local electronics store for your home broadband Internet connection is actually a pretty effective firewall. Why or why not?

How does Network Address Translation (NAT) increase firewall effectiveness?

3
  • it doesn't increase anything. it just blocks unwanted ports with iptables and has some filters for ddos and malicious attacks. also NAT is just a nickname for crap router security. Jul 21, 2014 at 8:24
  • 3
    this looks like a homework question ...
    – schroeder
    Jul 21, 2014 at 19:47
  • @H3lp3ingth3p33ps, Your comment on NAT leaves much to be desired. Aug 22, 2016 at 12:48

3 Answers 3

1

I'm not a network person, this answer could probably suffer a lot of (incl. terminology) improvements! Feel free to edit/comment.

NAT is not a security feature originally, but in practice it does implement a form of port blocking which has proved very useful for OSes that are shipped with many open ports and contained implementation mistakes (hi there Windows Vista SMB exploit). NAT is not a security feature. It's designed to permit reuse of IP addresses in order to increase the scalability of networks.

If your home computer is shipped to you by default with open ports for file sharing on the local network, then it having a unique IP address assigned by your ISP allows any script-kiddy or robot to send packets on those ports.

On the other hand, the home computer connected to a NAT-using home router to contact the Internet cannot receive data from arbitrary machines on the Internet. It can be contacted by other machines on the LAN and by servers when there is a NAT traversal rule set up. This happens:

  • when you initiate a connection to an Internet server, in which case the router will modify the IP in your packet to its own public IP and the port you used to a randomly allocated port. It'll then transfer the traffic receiving on that port to your machine
  • when you use NAT traversal protocols (e.g. UPnP) to create such a traversing port on-the-fly so that other Internet clients can contact you. This is used in P2P apps of all kinds. Some routers are configured to let local machines create temporary traversal rules on the fly, others are not
  • when you manually configure your router to permanently forward incoming packets on a specific port to a local machine; usually because you have a server running which you want to be accessible
1

the cheap $50 router you can pick up at your local electronics store for your home broadband Internet connection is actually a pretty effective firewall.

It's better than nothing, that's for sure. However.....

Why or why not?

What a home level router does good is prevent external parties from initiating & establishing a connection to the resources on your network.

The reason why a home based router is less effective as a firewall is because it allows essentially all traffic originating from your network to reach out. (with the exception of a few things, like NetBIOS, etc)

Most enterprise level admins subscribe to practice of whitelisting access, meaning that unless that access has been explicitly defined the traffic is blocked.

This can be an extremely tedious task for a home network, especially if you're a gamer. You'd be surprised how many different ports and destinations come in to play.

How does Network Address Translation (NAT) increase firewall effectiveness?

It doesn't increase effectiveness per say, what it does do is allow you to "hide" several internal assets behind an "external" IP address.

Without going in to too much detail, there are only specific ranges of IP addresses that are routable on the internet. The assets on your internal network (ie: behind the router) have addresses that are not routable. The external interface on your router hosts the "external" IP and keeps track of who is making requests on your internal network and "translating" the traffic accordingly.

0

I assume that you are aware of what NAT is. In case you do not know NAT is the method of mapping the external ip that is public ip to internal ip. After NAT, users inside the network sees the ip of server as the internal ip just as 192.168.XXX.XXX and outise user sees the server ip as public ip 105.XXX.XXx.XXX This help to add extra layer of security to the system. It is like masquerading your system or network from outside network. I think NAT adds certain layer of effectiveness in security for firewall.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .