Hot answers tagged

70

There is some widespread confusion about NAT. NAT has never been meant to be used as a security feature. However, it so happens that in most cases (not all), when a machine has access to the Internet through NAT only, then the machine is somehow "protected". It is as if the NAT system was also, inherently, a firewall. Let's see how it works: An IP packet ...


39

The cameras are often designed for ease-of-use by people who want to watch the streams of their goldfish or children. To make it easy to use, the cameras often call home to the manufacturer's website for remote viewing. Often these sites are insecure. Another method is UPnP sets up automatic port forwarding: https://en.wikipedia.org/wiki/...


24

Typically this happens with in a few scenarios End-user puts the device in the DMZ because they want to access it remotely and can't be bothered trying to figure out port-forwarding rules. This might happen if a user is Torrenting or has a NAS or other device they want to access from the public internet. User has allowed direct access to the device via ...


12

Usually it's not the command and control infrastructure which connects to the bots, because it can not magically know when a system gets infected. It's the botnet clients which contact the C&C infrastructure and ask for commands. Most routers (at least in the consumer segment) are configured to blindly forward any connections from inside the network to ...


10

Biggest issue to me in removing NAT is the reduction of privacy. With IPv6 I notice all my LAN devices have a unique public IPv6 address, which allows each device on a LAN to be identified uniquely. Which then allows easier identification of individual devices and users. Privacy implications like the ability to track your activity across domains. Ad ...


10

It is possible that the camera is still reachable from the network, even if UPnP, port forward is disabled, and the camera is behind NAT. Some camera manufacturers use "UDP hole punching method".The API looks like the following: The camera sends UDP packets to a server every 30 seconds or less. This makes this connection alive, thus the camera can be ...


9

A lot of these devices will use Universal Plug and Play (UPnP), a service that runs on many consumer routers and devices, allowing network devices to effectively add port forwarding rules on the router. Many consumers are unaware of this behavior and will thus have their devices exposed to the internet. This is just another example of IoT manufacturers ...


8

Note: the details of this answer will assume you use a Linux box as your firewall. If you use another platform details may vary but most of the principles should still hold. I'm wondering how to use NAT with IPv6. Nat for ipv6 is strongly discouraged by IETF. nevertheless there are implementations out there if you really want it. For example linux added ...


8

I suppose that our situation is the following: you have detected some undesirable network traffic and you are looking for the perpetrator, so as to, more or less metaphorically, convey to him the inherent unwisdom of his villainous behaviour. The source address of the offending IP packets points to a college; the college uses Network Address Translation so ...


7

I must disagree with @vahid. If there are multiple hops between the NAT and the host to which the connection is being port-forwarded, you may actually be able to elicit an ICMP TIMEX message. As you may know, every IPv4 packet has a 1 byte TTL field. If you determine the distance to the NAT (say 10 hops) and the actual concealed host is actually 12 hops (...


6

There are three likely behaviors as the packet is sent from the LAN to the router: The router apply reverse route filtering and drop the packet. The router does not filter. Instead the router treat it like any other packet from the LAN, which means the source IP is replaced with the IP of the router, and the router create a connection tracking entry. The ...


6

Much depends on your scenario. If the two hosts collaborate, just have one of the two send its IP to the other. Optionally hash/encrypt it in order to keep protocol rewriting filters (such as ftp-masq) from rewriting not only the header packet IP but the payload too. Then, if the two addresses don't match, NAT must have been at work. If you only have one ...


6

This question brought back some memories of when I created (with the help of a friend) a small tool to detect the presence of NAT in networks. The idea is quite simple (inspired/stolen from the NAT traversal technique in IPSec): You have network segment A and network segment B, and you want to detect the presence of a NAT between them. Send a TCP packet ...


5

NAT is often misunderstood because in todays "office routers" there is as good as in every case a combination of NAT/PAT and a firewall which isn't the same. Also when you say NAT most people really mean NAT/PAT which is a combination of Network Address Translation and Port Address Translation. This means that the router which is providing NAT/PAT ...


5

NATs are not really magically more secure than public addresses (and have a lot of nasty warts of their own, due to the nature of address translation). To route to your private ipv4 address, an attacker simply needs to point at your router, and then it's entirely up to the firewall to filter out that traffic. The switch to ipv6 won't change anything in that ...


5

NAT acts as a firewall with a "default deny" policy for unsolicited incoming packets, but no other rules. Because the machines behind a NAT box are not directly addressable (usually because they have private IP addresses), machines out on the general Internet cannot send IP packets to them directly. Instead, any packets will be sent to the address of the ...


5

If both devices have their own connection to the VPN this can probably be detected at the ISP level. While the details vary between VPN protocols it should for example be possible to detect key exchanges with multiple inside devices in case of IPSec or OpenVPN and independent TCP connections with TLS based VPN. Even if a single device has no permanent ...


4

You're mixing stuff up. The Tor browser runs locally, on your machine, the machine with the network card that has the MAC address. So, that MAC address never by itself leaves the local network. The internet doesn't care you're using Ethernet locally. As you said, this might have been done to strip people of anonymity. It doesn't matter that you can't be ...


4

NAT is mostly a non-issue with IPv6. As you say using a firewall (which should even be used with NAT, because NAT is not a proper security measure by itself) is the proper solution. Hiding the client's IPv6 address will only cause problems for protocols, traceability and security's Knowing the client's actual address makes writing firewall rules so much ...


4

NAT as used in typical SoHo routers implicitly protects you from direct access from outside into your network. And that's about all it does. Specifically it does not protect you against anything which is initiated from inside, like opening a mail or visiting some external web site. NAT will not protect against scanning the internal network if this scanning ...


4

Common NAT* as implemented in SoHo routers (i.e. DSL, FTTH, cable etc) maps multiple internal (local) IP addresses to a single external (public) IP address. Reaching an internal system from outside requires a way to translate a packet coming in on the external (internet) interface (i.e. using the external IP+port as destination) to a packet on the internal ...


3

It depends on your router settings. If your router have filtering in place, it will drop the packet, as it's source address is not from any networks known by the router. I usually configure my gateways/firewalls/routers to do this. If your router does not have any filtering (the most common scenario) it will change the source address on the packet to its ...


3

My network admin is convinced that NATing via proxy is enough for protection... used basically to protect from outside attackers, malwares from internet, dns spoofs, and any network based attacks. NAT helps to restrict access to systems inside an internal network from outside the network in that it only allows data from outside if a matching connection was ...


3

Is it possible to configure iptables in a way that such incoming connections are blocked? When browsing the web there are no incoming connections. All connections originate locally at the browser which requests a response from a specific web server. And the HTML/script in the response then causes the popup to display. Thus any attempts to block popups must ...


3

In a simple answer (if I'm understanding this correctly), yes. You can accomplish this by utilizing reverse SSH tunneling. You'll need to setup the tunnel on "B" first utilizing socks proxying (can be done through Putty), then you'll need to route your traffic through "A" for the requests. When the responses return, they'll be directed through "A", back ...


3

It's not likely a sizable number of users at some very large company will suddenly access the same resource on your server time and time again, out of nowhere. It's possible, but hardly happens, if all. DoS almost all the time cause a very large spike on traffic, way more than a Slashdot effect, for example. Something like this: It's an old picture, but ...


3

Saturating bandwidth capacity of an entire ISP is very well possible and unfortunately happens on a daily basis. You’re right that with techniques like carrier grade NAT and end user may not have a dedicated IPv4 address, but that can still result in an outage when attacked. And of course, if the ISP deployed IPv6, it can be possible to uniquely target the ...


3

Apart from being unintentionally DDOS if the DNS server is found and being used but botnets etc., what is the risk of doing that? I guess some people scanning the web may eventually find that DNS server and use it for some (bad) reasons, but in the end is my LAN at risk? Any open port increases the attack surface, in theory. Your LAN could be at risk ...


2

NAT is a technique a router can use to allow the hosts connected through it to share a single IP address. The router keeps track of which hosts have connections and hosts can ask to have certain data routed towards them. Games for example will typically ask for UDP traffic at a certain port to be redirected. Reversely any packet that doesn't seem to be ...


2

What you are trying to achieve is not possible, by design. The only way of achieving this is by having access to either the gateway or the host machine. A NAT device serves the dual purpose of sharing an internet connection with an internal network and protecting the internal network much like a traditional firewall would. [edit] I stand corrected. The IETF ...


Only top voted, non community-wiki answers of a minimum length are eligible