Have firewall, no NAT: is putting in NAT worth the hassle?

Forums › LAN (ethernet/Wifi/routers/Bluetooth) › Have firewall, no NAT: is putting in NAT worth the hassle?

omw

3 posts

Wannabe Geek

#143906 30-Apr-2014 23:42

I've been asked for my opinion about a network that has all its equipment on a public IP range (ie no NAT) whether they should go for adding NAT to the mix to help security (there's a pretty good firewall). IMHO NAT was useful about a decade ago as a security option, but nowadays it adds nothing much apart from unneeded complications. I'd be interested in second opinions. . . .

ubergeeknz

3344 posts

Uber Geek
+1 received by user: 1041

Trusted

Vocus

#1034421 30-Apr-2014 23:47

NAT is a hack. In a way, I guess so are Firewalls... but I digress. There's no good reason to NAT for "security" reasons. If you have a correctly configured firewall, that is quite sufficient.

johnr

19282 posts

Uber Geek
+1 received by user: 2526
Inactive user

#1034424 1-May-2014 00:00

No just have a good firewall

gjm

810 posts

Ultimate Geek
+1 received by user: 122

#1034473 1-May-2014 08:18

1) Find out that they own a /8 address space
2) Put NAT in and sell public IP range
3).
4) Profit $$$

...and if that fails, as people said above there's no reason to NAT.

Do surveys for Beer money (referral link) - Octopus Group

Link for buying beer (not affiliated, just like beer) - Good George

Inphinity

2780 posts

Uber Geek
+1 received by user: 1184

#1034520 1-May-2014 09:09

Not for security, no, waste of time.

bakewells5856

72 posts

Master Geek
+1 received by user: 17

#1034523 1-May-2014 09:10

only reason to use NAT is if you have more devices than you have IP addresses, otherwise its just adding processing overhead for nothing.

Dynamic

4015 posts

Uber Geek
+1 received by user: 1850

ID Verified

Trusted

Lifetime subscriber

#1034543 1-May-2014 09:29

NAT blocks requests from the outside world by default. Specific pinholes in the NAT allow specific traffic in.

A firewall can easily be mis-configured.

Think Onion. Layers of protection.

“Don't believe anything you read on the net. Except this. Well, including this, I suppose.” Douglas Adams

Lenovo

Shop now for Lenovo laptops and other devices (affiliate link).

solival

160 posts

Master Geek
+1 received by user: 20

#1034822 1-May-2014 14:03

When NZ at least become IPV6, NAT will go i history as rudimentary technology. As for now you can use it if you want to free some IP's. It's improve security a bit (by blocking by default income connections) by price of complexity (port forwarding, port-triggering, etc). But any good firewall does this anyway, so why bother?

Geek originally from Ukraine :)

hashbrown

463 posts

Ultimate Geek
+1 received by user: 131

#1034869 1-May-2014 15:08

johnr: No just have a good firewall

Just have an average firewall and get someone good to configure and maintain it.

I've seen very expensive firewalls rendered useless by muppets who had no clue what they were doing.

omw

3 posts

Wannabe Geek

#1034924 1-May-2014 15:47

gjm: 1) Find out that they own a /8 address space
2) Put NAT in and sell public IP range
3).
4) Profit $$$

Selling is an option, but I understand that you can't trade in them (except if you're called Microsoft). Do you know of anyone in the nz space that has successfully sold/purchased blocks, and the amount?

solival

160 posts

Master Geek
+1 received by user: 20

#1034927 1-May-2014 15:54

This could be additional cost for every external ip. Getting rid of expenses is almost a profit :)

Geek originally from Ukraine :)