Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

NATs provide one form of network segmentation. Network segmentation is a commonly accepted network security practice. The author maybe thinking of a specific application of NAT, but a blanket “NAT provides no additional security” is not a defensible position.


The NAT position is long-parroted IPV6 zealotry.

These people saying "the idiots with NATs will turn them off to get things running", but think that "the idiot user" with firewall-only setups won't .... turn off the firewall as the first (and last) debugging step?

And the assumption that whatever ipv6 space assigned you/your device will be sufficient is ... optimistic. I can easily see some CGNAT thing giving a single ipv6 to your mobile device and you need to NAT on your end to do more fun things. It doesn't matter than ipv6 can address every atom in the universe. Sine lazy ISP is going to decide your endpoint a single atom.


Thank you for the voice of sanity.

(And anyways, stateful firewalls are a special case of a simple NAT. If you're doing stateful address mangling anyways, why not do something actually useful and hide your LAN addresses?)




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: