0

i don't know if i have duplicated a questions..but then i still want to ask which one is more risky to be deploy in networking will it be PAT or NAT

PAT will make it risky for routing as it will redirect all traffic to the host but what if they use reverse connection..only certain ip will connect back to destination via certain port..so what will be the best solution for this issue

p/s sorry if my question is not specific enough

Improve this question
4
  • 1
    Please use a real stateful-inspection firewall if you want security. One common (and free) stateful-fw is pfSense... even OpenWRT has a firewall.
    – Mike Pennington
    Mar 8, 2014 at 22:09
  • If you are afraid of a server being accessed and compromising your private network it may be safer to place it in a less trusted zone or DMZ. Then secure the zone with a firewall and IPS system.
    – HAL
    Mar 10, 2014 at 15:29
  • PAT is really made up. The RFCs use NAPT for what some people call PAT. See RFC 2663, IP Network Address Translator (NAT) Terminology and Considerations, Section 4.1.2 Network Address Port Translation (NAPT): "NAPT extends the notion of translation one step further by also translating transport identifier (e.g., TCP and UDP port numbers, ICMP query identifiers). This allows the transport identifiers of a number of private hosts to be multiplexed into the transport identifiers of a single external address." There is more in the RFC.
    – Ron Maupin ♦
    Jan 30, 2017 at 15:50
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin ♦
    Aug 10, 2017 at 3:20

2 Answers 2

Reset to default
8

For all practical purposes, NAT and PAT provide no network security, and should not be relied on for that purpose.

That said, because PAT often is used with a pool of temporary addresses, a host only has a public address for as long as it is actually sending data to the Internet. If it stops, the translation expires, and the host is no longer reachable from the Internet.

If you have static 1:1 translations, e.g., for a web server, there is no similar benefit.

Improve this answer
5
  • but then for reverse connection, there is no need for PAT or NAT as the server itself is connecting back to us..maybe we can set up a cron job for the server to keep connecting to us so we(let say our personal computer) will just have to listen for specific port waiting for the connection from the server..how about it?
    – Fakhri Zulkifli
    Mar 9, 2014 at 10:03
  • 1
    @d0lph1n, I'm not sure I understand what you're getting at. What are you trying to accomplish?
    – Ron Trunk
    Mar 9, 2014 at 22:27
  • I'm sorry if i am just making things more complicated..i just trying to argue with you if we can use reverse tunneling for the long-term access from public network to the private server which is i think more secure than applying NAT or PAT..and this also might be the other method other than VPN
    – Fakhri Zulkifli
    Mar 10, 2014 at 12:53
  • 1
    You still need NAT for your reverse tunnel. Otherwise, how will your tunnel traffic reach the server?
    – Ron Trunk
    Mar 10, 2014 at 20:29
  • thank you for the info..im learning a lot from you guys..sorry for not being specific..i will do a more thorough research about NAT and PAT
    – Fakhri Zulkifli
    Mar 12, 2014 at 3:23
0

It is well known that a server is a system that offers a service. It is also well known that a server to offer a publicly available service needs a way to be reached from the outside network (the Internet).

In the modern netwrok scenario having a public IP has a cost. Techniques like NAT and PAT have been introduced to make less urgent the need of a public IP address allowing a server with a private IP to be accessed from a public network.

When dealing with security you are always facing with the usability. If increasing security means decreasing usability, probably, it will translate into decreasing security [reference here] (I'm refering to comments where you are proposing some kind of reverse tunneling).

So essentially NAT and PAT are not inherent secure or insecure. They are just means for a service to be accessed from a public net. If you are concerned with security focun on the security of the infrastructure (with a firewall for example).

Ironically you coul see a security issue even in electricity.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.