Experten aus dem binsec-Universum

NAT Is Not a Security Measure

NAT (Network Address Translation) is not a security measure. The belief in the protective power of NAT for securing a network never dies. NAT serves exclusively to counter the shortage of ipv4 addresses. NAT usually translates private IP addresses that do not exist on the Internet, such as 192.168.1.1/32, into publicly reachable addresses.

In a home environment the NAT on the DSL router does "protect" the private network. That is true. But only as a side effect, because with NAT the clients on the private network are not reachable from the outside. That is not the actual purpose of NAT, though. You achieve the same protection by limiting inbound traffic on a router or a firewall. You do not protect a corporate network by sticking it behind a NAT router. That is what firewalls are for. Not NAT.

Back to blog