1

Let's say a NAT64 Router only has 1 IPv4 address for bindings, meaning the NAT64 router has a roughly 65535 IPv4 transport addresses. A malicious attacker can then exhaust the entire IPv4 transport address space by performing 65535 request to network on the other side of NAT64 Router with spoofed source IPv6 transport address (IP and port).

How can I possibly mitigate/anticipate such scenario?

1

Let's say a NAT64 Router only has 1 IPv4 address for bindings, meaning the NAT64 router has a roughly 65535 transport addresses.

That simply is not true. Transport addresses are per protocols (TCP port 12345 is not UDP port 12345), and a NAT table actually uses the source and destination IP and source and destination transport addresses. You have many, many times 65,535 address combinations for possible table entries for each protocol.

A malicious attacker can then exhaust the entire IPv4 transport address space by performing 65535 request to network on the other side of NAT64

That is untrue. It is unlikely that an attacker can exhaust all the possible address combinations. What you need to worry about are the table resources. The NAT device will have a limited amount of RAM for the NAT tables (one table for each of TCP, UDP, and ICMP). A device set up for NAT64 will have far more RAM for that than a normal router, but there is still a limit, and the table space can be exhausted, but the table entries will also have a timeout. This is far less of a problem than you may imagine.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.