← Back to context

Comment by tsimionescu

23 days ago

Sure, but the Internet will not route packets going to RFC1918 addresses. So, if you're using an RFC1918 address on the LAN side of the router like every sane admin, packets that actually arrive to the router from the Internet with an IP address other than the router's own IP address will get dropped. And those that arrive at the router with the router's own IP address and a port that doesn't correspond to either an open connection or an explicit port forwarding rule will also get refused.

This is all behavior that happens even with no firewall whatsoever.

10 comments

tsimionescu

Reply
Dagger2  23 days ago

So? How is any of that relevant?

  • tsimionescu  23 days ago

    Because this is exactly what the GP was claiming, and you denied: even without a firewall, packets that don't correspond to an open connection will get dropped by a NAT, even without a firewall. Sure, maybe "dropped" is wrong, as the NAT box will probably instead send a RST packet, but this is almost entirely irrelevant.

    • Dagger2  23 days ago

      Right, we were talking about NAT. So how is any of that non-NAT-related stuff relevant?

      > Sure, but the Internet will not route packets going to RFC1918 addresses

      This is about RFC1918, not NAT.

      > So, if you're using an RFC1918 address on the LAN side of the router like every sane admin, packets that actually arrive to the router from the Internet with an IP address other than the router's own IP address will get dropped.

      This is about reverse path filtering, not NAT.

      > And those that arrive at the router with the router's own IP address and a port that doesn't correspond to either an open connection or an explicit port forwarding rule will also get refused.

      And this is... actually not true. If there's a server listening on the relevant port, the connection is accepted.

      2 replies →