14
NAT vs firewall at home (programming.dev)
submitted 10 months ago by to c/networking@sh.itjust.works
21 comments fedilink hide all child comments
 

Why would I need to have software firewalls on my devices behind my NAT router at home? The topology is a basic consumer grade one: ISP -> my router (NAT) -> LAN, and vice versa.

If NAT already obfuscates my private addresses through translation, how would a potential adversary connect to anything beyond it?

What "good" would my public IP do for a hacker if I have no ports forwarded?

Is a firewall a second line of defense just in case I execute malware that starts forwarding ports?

I do have software firewalls on all my devices, but that wasn't an informed choice. I just followed the Arch Wiki's post installation guidelines.

you are viewing a single comment's thread
view the rest of the comments
[–] [S] 1 point 10 months ago (1 child)

I quick search led me to: https://www.tencentcloud.com/techpedia/101586

However, in an ordinary consumer grade scenario, I don't see how anybody other than the ISP could send ICMP messages to one's router, which is why I don't worry about it.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 2 points 10 months ago

    ICMP is important for routing related functions like MTU detection. I would allow all ICMP but if you much block it for some reason make sure to whitelist packet too big and probably destination unreachable.

    On a modern connection ping is not much of a threat as it takes minimal resources to respond. Modern hardware can handle thousands of pings with no issue.

  • permalink
  • fedilink
  • source
  • parent