Is NAT can provide some kind of protection?

Owen DeLong owen at
Wed Jan 12 13:57:34 CST 2011

On Jan 12, 2011, at 11:21 AM, Paul Ferguson wrote:

> Hash: SHA1
> On Wed, Jan 12, 2011 at 11:09 AM, Owen DeLong <owen at> wrote:
>> No, NAT doesn't provide additional security. The stateful inspection that
>> NAT cannot operate without provides the security. Take away the
>> address mangling and the stateful inspection still provides the same
>> level of security.
> There is a least one situation where NAT *does* provide a small amount of
> necessary security.
> Try this at home, with/without NAT:
> 1. Buy a new PC with Windows installed
> 2. Install all security patches needed since the OS was installed
> Without NAT, you're unpatched PC will get infected in less than 1 minute.

Repeat the experiment with stateful firewall with default inbound deny and no NAT.

Yep... Same results as NAT.

NAT != security. Stateful inspection = some security.



More information about the NANOG mailing list