"NAT is a firewall"

networkingsecurity

The belief that address translation is a security control. NAT hides topology as a side effect, but it filters nothing by policy - a stateful firewall does.

The confusion comes from home routers bundling both; RFC 4864 exists partly to untangle 'NAT security' from actual protection, and IPv6 without NAT reopened the debate.

The belief that NAT is a firewall is one of the most persistent and consequential misconceptions in networking. NAT does prevent unsolicited inbound connections, which is why the belief survives, but it does so as a side effect of having no translation entry for traffic nobody requested rather than as a security decision.

The distinction has teeth. A firewall inspects traffic against a policy you wrote, logs what it denied, and enforces rules on outbound traffic as well as inbound. NAT does none of that: it has no policy, no concept of allowed and denied, no logging of decisions it never made, and it applies no restriction whatsoever to anything a host inside chooses to initiate. Malware calling out is entirely unaffected.

The consequence is a large number of flat internal networks sitting behind a device everyone assumed was protecting them, where any compromised host can reach every other host without passing a single control. IPv6 removes the accidental protection along with the address scarcity that caused it, which is why deployments that treated NAT as security discover they need an actual firewall policy for the first time, and why that discovery should happen deliberately rather than during an incident.

Disputed / commonly mistold A popular version of this story is inaccurate - see the note above.

Also known as: nat security myth

← All glossary entries