Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
Truth or bald-faced lie: the cheap $50 router you can pick up at your local electronics store for your home broadband Internet connection is actually a pretty effective firewall. Why or why not?
How does Network Address Translation (NAT) increase firewall effectiveness?
I'm not a network person, this answer could probably suffer a lot of (incl. terminology) improvements! Feel free to edit/comment.
NAT is not a security feature originally, but in practice it does implement a form of port blocking which has proved very useful for OSes that are shipped with many open ports and contained implementation mistakes (hi there Windows Vista SMB exploit). NAT is not a security feature. It's designed to permit reuse of IP addresses in order to increase the scalability of networks.
If your home computer is shipped to you by default with open ports for file sharing on the local network, then it having a unique IP address assigned by your ISP allows any script-kiddy or robot to send packets on those ports.
On the other hand, the home computer connected to a NAT-using home router to contact the Internet cannot receive data from arbitrary machines on the Internet. It can be contacted by other machines on the LAN and by servers when there is a NAT traversal rule set up. This happens:
the cheap $50 router you can pick up at your local electronics store for your home broadband Internet connection is actually a pretty effective firewall.
It's better than nothing, that's for sure. However.....
Why or why not?
What a home level router does good is prevent external parties from initiating & establishing a connection to the resources on your network.
The reason why a home based router is less effective as a firewall is because it allows essentially all traffic originating from your network to reach out. (with the exception of a few things, like NetBIOS, etc)
Most enterprise level admins subscribe to practice of whitelisting access, meaning that unless that access has been explicitly defined the traffic is blocked.
This can be an extremely tedious task for a home network, especially if you're a gamer. You'd be surprised how many different ports and destinations come in to play.
How does Network Address Translation (NAT) increase firewall effectiveness?
It doesn't increase effectiveness per say, what it does do is allow you to "hide" several internal assets behind an "external" IP address.
Without going in to too much detail, there are only specific ranges of IP addresses that are routable on the internet. The assets on your internal network (ie: behind the router) have addresses that are not routable. The external interface on your router hosts the "external" IP and keeps track of who is making requests on your internal network and "translating" the traffic accordingly.
I assume that you are aware of what NAT is. In case you do not know NAT is the method of mapping the external ip that is public ip to internal ip. After NAT, users inside the network sees the ip of server as the internal ip just as 192.168.XXX.XXX and outise user sees the server ip as public ip 105.XXX.XXx.XXX This help to add extra layer of security to the system. It is like masquerading your system or network from outside network. I think NAT adds certain layer of effectiveness in security for firewall.
