We have a single router (4331) that connects to our ISP. We do PAT (dynamic nat) to give users internet access. Now typically we'd have an OUTSIDE-IN ACL that blocks traffic from the internet. My question is, if we're using PAT and have no static 1-to-1 translations, do we even need an ACL? If yes, what would be the attack that an ACL would prevent?

  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer.
    – Ron Maupin
    Dec 25 '18 at 8:26

Your router itself needs protection. Any traffic coming into the router for the router address that is not part of the NAPT (see RFC 2663, IP Network Address Translator (NAT) Terminology and Considerations, PAT is a misnomer for NAPT) will be handled by the router. An attacker could try to take over the router on standard protocols (telnet, HTTP, NTP, etc.). If you log access attempts on the ACL, you will see a lot of automated attempts to compromise the router.

Don't confuse NAPT with security. Your router needs to be secure. If your router is compromised, it doesn't matter if you have any version of NAT for your LAN, the router has full access to the LAN, and anyone controlling the router will have full access to the LAN.

Your LAN needs to be protected by a firewall (either a separate device, or a software firewall on the router). NAT is not security, and your are making a mistake if you assume that.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.