undefined | Better HN

0 pointsimoverclocked4y ago0 comments

You can simply not route a specific range, no firewall needed.

NAT, on its own, doesn't provide security. At best, it provides obscurity. At worst, it breaks security [2]. NAT needs a properly configured firewall to provide security [1]. In this sense, NAT vs a Firewall is a false dichotomy.

[1] https://tailscale.com/blog/how-nat-traversal-works/

[2] https://www.computerworld.com/article/2556611/nat-traversal-...

edit: formatting

0 comments

2 comments · 1 top-level

tsimionescu4y ago· 1 in thread

I wasn't claiming NAT is adding security. A combined IPv4 NAT/firewall will not necessarily be less performant than an IPv6 firewall - that was my claim.

Also, GP claimed that certain services that don't work because of NAT would work on an IPv6 network. I was curious which services those might be, that don't work because of NAT but wouldn't be affected by a firewall.

Dagger24y ago

If you're behind CGNAT then generally you won't be able to accept any inbound connections, so even things like a basic webserver aren't doable.

j / k navigate · click thread line to collapse