4

I'm deploying a new network for IOT devices, this new network will be behind a firewall. I've been suggested to also get the network natted to further improve security. Does this really add any security benefits? With a firewall I already have to explicitly allow any communication, adding NAT would make the managment (SSH, ansible) of this devices harder since I would also have to forward the ports or use agents instead of just allowing the communication in the firewall.

Improve this question
3
  • 5
    NAT has nothing to do with security, it is a kludge to extend the life of IPv4 until IPv6 is ubiquitous. Security comes from firewalls. IoT should really be using IPv6, and it does not have NAT.
    – Ron Maupin ♦
    Nov 8, 2022 at 17:23
  • 1
    You should also ask security questions on Information Security.
    – Ron Maupin ♦
    Nov 8, 2022 at 17:24
  • Are you sure that whoever suggested it meant NAT and not just a separate wifi network. In some sense this will be similar to NAT. Not sure if this is an enterprise or home question, but a good suggestion is to have a separate (guest)network for IOT devices if they only need access to the internet, but you want to keep them separated from your computers and other devices.
    – Viktor Mellgren
    Nov 10, 2022 at 9:18

4 Answers 4

Reset to default
11

No.

I agree with @RonMaupin in the comment: NAT is not a security feature but a workaround for the lack of IPv4 addresses.

NAT only add complexity without increasing security, if the network and the hosts are properly secured by appropriate measures (including, but not limited to, firewalls). Security does not reside in a single point.

Improve this answer
3
  • Please can you clarify? Is it correct for me to understand this such that if I have a public IP, IPv6 devices inside the network that has NAT (like most typical home networks) are still directly reachable? I thought that the router will not accept any connections that are not explicitly routed or part of a TCP connection.
    – Tomáš Zato
    Nov 10, 2022 at 9:45
  • 1
    @TomášZato "are still directly reachable?" No. Just because they have a public IPv6 address, the are not necessarily reachable from the outside if the firewall prevents it. That's what firewalls do.
    – Marc 'netztier' Luethi
    Nov 10, 2022 at 9:53
  • 2
    @TomášZato NAT is about allowing multiple devices to share one network address. IPv6 has enough addresses to assign multiple unique address to every grain of sand on the planet, so there is no need to share them. If your internet connection is IPv6 enabled, you won't have "a public IP address", your devices will be addressable via their own unique IPv6 addresses. Whether they are accessable is, as stated on this page, subject to firewalls and other security measures. (If your internet connection is not IPv6 enabled, IPv6 devices have to "tunnel" their traffic through the NATed IPv4.)
    – IMSoP
    Nov 10, 2022 at 9:57
4

Just to add to JFL's answer: while not increasing security, NAT does add complexity to the setup, as you've pointed out. Complexity is your foe when trying to secure things.

In a nutshell: if you can work without NAT, that's generally better and likely more secure.

Improve this answer
4

NAT was never designed to be "security". It was a mechanism to increase the IPv4 address pool. (many behind one) In that era, no one was very concerned about security.

The security NAT appears to provide is an illusion. Just because your laptop isn't directly addressable from the public internet doesn't mean much, and there are a great many ways to punch a hole. But that's also about as far as most people's "firewalls" go: default deny inbound, allow outbound, no inspection of traffic in either direction. Without any intelligence on the traffic moving around, you don't have any security. You have no idea if anyone has made it into your network, or how they got there.

Your IOT network likely doesn't need the complication of NAT. When devices outside the firewall want to talk to some of those trinkets, you'll be glad there's no NAT.

Improve this answer
4

Flip it around - when you deploy IPv6 on this network there will be no NAT, so why add complexity now that won't be available later.

Worse, if you dual-stack the network then v4 would have NAT and v6 won't. That could lead to confusion and outages all by itself.

The only reason for not futureproofing is that some IOT things don't do v6 yet. Don't paint yourself into a corner with a design.

NAT adds complexity but not security.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.