Network Address Translation ( NAT ), seems to sort of act as a firewall for the hosts behind it because they are not available. Although I would never rely on this as my firewall, what are its failures as a firewall?
I am asking this for what I would call 'academic' reasons. I am aware the NAT will not protect people from getting into the firewall device itself, and that more layers of security is better. I am more interested in how if NAT was being used for this purpose, how NAT itself might be exploited.
Update, For example:
One public IP: 10.10.10.10
One LAN: 192.168.1.1/24
If all outgoing traffic from the lan has outgoing NAT to 10.10.10.10, and the only other NAT mapping is 10.10.10.10 port 80 mapped to 192.168.1.100. How might port 22 on 192.168.1.50 be accessed?
Best Answer
With NAT, IP addresses in the internal network are not routable from the external one; the comparison with a firewall is not completely correct, because a firewall filters network traffic which, ordinarily, should be able to flow through it; NAT reshapes traffic that ordinarily shouldn't be able to flow that way, allowing it to flow under some specific rules.
A firewall guards a door that would be otherwise open.
A NAT opens a door where there isn't one.
With a firewall you could allow all traffic from the external network to the internal protected one; with a NAT you couldn't, even if you wished.
They're two totally different things, even if they're often confused; as far as security is concerned, a private-IP network behind a NAT is actually more secure than a public-IP network behind a firewall.
Update to respond to your example
That's exactly what I was talking about; in your case, 192.168.1.50 isn't addressable from the outside, so there's absolutely no way it can be accessed, unless you explicitely forward some external IP/port to it.